CVE-2026-87522: Chrome Android WebView Auth Bypass Flaw

CVE-2026-87522 is an authorization bypass flaw in Google Chrome WebView on Android that enables attackers to bypass system access restrictions through social engineering and crafted network traffic. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-87522 Overview

CVE-2026-87522 is a missing authorization vulnerability [CWE-862] in the WebView component of Google Chrome on Android. Versions prior to 153.0.8010.36 fail to enforce system access restrictions on certain WebView operations. A remote attacker who convinces a user to interact with crafted network traffic can potentially bypass those restrictions. Chromium classifies this issue at Low security severity. Exploitation requires social engineering, which limits opportunistic mass abuse but does not eliminate risk for targeted campaigns against mobile users.

Critical Impact
Remote attackers leveraging social engineering may bypass WebView system access restrictions on unpatched Android Chrome installations, potentially exposing data or functionality that should be gated by authorization checks.

Affected Products

Google Chrome for Android prior to 153.0.8010.36
Android applications embedding the affected Chrome WebView component
Chromium-based mobile browsers sharing the same WebView code path

Discovery Timeline

2026-09-09 - CVE-2026-87522 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87522

Vulnerability Analysis

The flaw resides in Chrome's WebView implementation on Android. WebView is the embedded browser engine that renders web content inside native applications and inside Chrome itself. The vulnerable code path does not verify that the caller is authorized to invoke a restricted operation before executing it. This is a classic missing authorization defect tracked under CWE-862.

An attacker cannot trigger the issue purely over the network. The advisory states that exploitation requires a user to be lured into interacting with crafted traffic, typically by visiting a malicious page or opening attacker-controlled content in an app that hosts WebView. Once the user interacts, the WebView component performs a privileged action without checking whether the invoking context should be permitted to request it.

EPSS currently scores this vulnerability at 0.287%, reflecting a low observed likelihood of exploitation in the near term.

Root Cause

The root cause is an absent authorization check in a WebView code path exposed to web content. The component trusts the calling context rather than validating it against the Android security model that governs which origins or applications may perform sensitive operations. Details are tracked in Chromium Issue Tracker #507219126.

Attack Vector

Exploitation follows a social engineering pattern. The attacker hosts crafted content that, when loaded by a vulnerable Chrome or WebView instance, issues requests the browser should reject. Because the authorization check is missing, the request executes and can bypass system access restrictions on the Android device. No authentication is required on the attacker side, and no code needs to be installed on the victim device beyond the vulnerable browser.

No verified proof-of-concept exploit code is publicly available. Refer to the Google Chrome Stable Update advisory for vendor guidance.

Detection Methods for CVE-2026-87522

Indicators of Compromise

Android devices running Chrome versions earlier than 153.0.8010.36 observed loading pages from unfamiliar or newly registered domains.
WebView-hosted content initiating unexpected requests to system URIs or intent:// handlers outside the app's normal behavior.
Mobile browsing telemetry showing redirection chains that end in pages designed to trigger WebView actions after minimal user interaction.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag any build below 153.0.8010.36.
Correlate mobile web proxy logs with URL reputation feeds to identify user visits to known social engineering infrastructure.
Review in-app WebView logs from managed Android applications for anomalous navigation events or unexpected privileged calls.

Monitoring Recommendations

Ingest Android Enterprise and MDM compliance data into your SIEM to track Chrome patch status per device.
Monitor for phishing lures that target Android users, as social engineering is a prerequisite for exploitation.
Alert on repeat visits by managed devices to domains flagged for hosting WebView abuse content.

How to Mitigate CVE-2026-87522

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store.
Push mandatory Chrome updates to enrolled devices using your Mobile Device Management (MDM) or Android Enterprise console.
Update the Android System WebView component alongside Chrome, as the fix applies to shared WebView code.

Patch Information

Google addressed the vulnerability in Chrome 153.0.8010.36 for Android. Distribution occurs through the Google Play Store and the Stable channel. Patch details are documented in the Google Chrome Stable Update release notes and the associated Chromium Issue Tracker entry.

Workarounds

Restrict browsing on unpatched devices to trusted domains using MDM browser policies until the update is applied.
Deliver user awareness communications reminding staff not to interact with unsolicited links on mobile devices.
Where feasible, temporarily switch high-risk users to an alternative, fully patched browser that does not share the vulnerable WebView code path.

bash

# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Force update check through the Play Store
adb shell am start -a android.intent.action.VIEW \
  -d "market://details?id=com.android.chrome"